SAP-C02 Continuous Improvement for Existing Solutions Practice Question
A company is using Amazon API Gateway with a Lambda authorizer to authenticate requests. The Lambda authorizer function times out frequently during peak traffic. The company wants to improve authorization performance without changing the authentication logic. Which TWO actions should the company take? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable caching of authorization responses in API Gateway.
(enabling caching of authorization responses) is correct because it caches the authorizer's response for a specified time, reducing the number of Lambda invocations during peak traffic and improving performance without changing authentication logic. Option C (increasing the Lambda function timeout) is correct because if the authorizer times out during peak traffic, increasing the timeout gives it more time to complete. Option B (using AWS WAF) is incorrect because WAF blocks suspicious requests at the web application layer, but does not improve the performance of the Lambda authorizer. Option D (increasing Lambda reserved concurrency) is incorrect because the issue is timeouts, not concurrency limits; reserved concurrency ensures capacity but does not prevent timeouts. Option E (enabling request validation in API Gateway) is incorrect because request validation checks request structure before reaching the authorizer, but does not affect authorizer performance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable caching of authorization responses in API Gateway.
Why this is correct
Caching reduces Lambda invocations for repeated requests.
- ✗
Use AWS WAF to block suspicious requests.
Why it's wrong here
WAF does not help with authorizer performance.
- ✓
Increase the Lambda function timeout.
Why this is correct
More time allows the authorizer to complete under load.
- ✗
Increase the Lambda reserved concurrency.
Why it's wrong here
The issue is timeout, not concurrency.
- ✗
Enable request validation in API Gateway.
Why it's wrong here
Request validation checks payload, not authorization.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?
hard- A.The Lambda function is returning a malformed IAM policy.
- B.The token has expired.
- C.The Lambda authorizer is not being invoked due to throttling.
- ✓ D.The authorizer result is cached, and a previous invalid token caused a deny policy to be cached.
Why D: API Gateway caches the authorizer result based on the token. If a previous request with the same token was denied (e.g., due to an invalid token at that time), the cached deny policy will be used for subsequent requests even if the token is now valid, causing a 401 error. Option A is incorrect because the Lambda authorizer is being invoked successfully and returning a policy; the issue is with caching. Option B is incorrect because the problem states tokens are valid, not expired. Option C is incorrect because throttling would result in the authorizer not being invoked, but the logs show it is invoked.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.